SPAM Act

Under the Spam Act 2003 it is illegal for businesses to send, or cause to be sent, unsolicited commercial electronic messages, including email, instant messaging, SMS and MMS.

Learn more

Complying with the Spam Act

Under the Spam Act 2003 it is illegal to send, or cause to be sent, unsolicited commercial electronic messages, including email, instant messaging, SMS and MMS (text and image-based mobile phone messaging).

If you are sending a commercial message, the message must satisfy the following three conditions:

• Consent – the message must be sent with the recipient’s consent
• Identify – the message must contain accurate information about the person or organisation that authorised the sending of the message
• Unsubscribe – the message must contain a functional 'unsubscribe' facility to allow the recipient to opt out of receiving messages from your organisation.

Messages do not have to be sent out in bulk to be considered spam. Under Australian law, a single electronic message can also be considered spam.

Commercial Messages

The Spam Act defines a commercial electronic message as any electronic message that:

• Offers, advertises or promotes the supply of goods, services, land or business or investment opportunities
• Advertises or promotes a supplier of goods, services, land or a provider of business or investment opportunities
• Assists a person to dishonestly obtain property, commercial advantage or other gain from another person

The Act classifies an electronic message as ‘commercial' by considering:

• The content of the message
• The way in which the message is presented
• Any links, phone numbers or contact information in the message that lead to content that has a commercial purpose - as these may also lead the message to be defined as 'commercial' in nature

This means that if you send a service type message to a customer but include a link to your website, and that website includes promotional activity then the message will be deemed by ACMA to be a commercial message.

Consent

Whether you're targeting new customers or managing existing databases, you always need a person's consent before you can send them commercial electronic messages. There are two types of consent: express and inferred.

a. Express consent

When an individual or organisation first provides their email address, and you plan to send them a commercial electronic message, you must first get their express consent.

Express consent can be gained in a variety of ways - for example by filling in a form, ticking a box on a website, over the phone, face-to-face or by swapping business cards - as long as the recipient is clearly aware that he or she may receive commercial messages in the future. You cannot send an electronic message to seek consent: this is in itself a commercial message, because it seeks to establish a business relationship.

Businesses should keep a record of all instances where consent is given, including who gave the consent and how. Under the Spam Act, it is up to the sender to prove that consent exists.
It is strongly recommended that in creating conditions of express consent ADMA members adopt practices that put it beyond doubt that the individual consented to receive an electronic commercial message. For example, organisations seeking to obtain permission to send e-marketing messages by competitions should prominently display at the top of the form and advertisements words to the effect of ‘Subscribe to our e-newsletter and go into the draw for….”

b. Inferred consent

Inferred consent can come about in two ways:

1. Through an existing business or other relationship, where there is a reasonable expectation of receiving those commercial electronic messages.

If an organisation has a strong business relationship with the holder of an electronic address – for example, the address holder is a member of a club, a subscriber to a service, or a client it deals with on an ongoing basis – consent to receiving messages from that organisation may be inferred.

If you are not confident that the existing business relationship is strong enough to infer consent, or are unsure that the recipient will want your messages, you will need to obtain express consent. You can do this by phoning the person and asking them for their consent so long as the individual’s number is not on the Do Not Call Register. Alternatively the organisation can send a direct mail to the individual except where the individual is on the Do Not Mail Service or has not otherwise opted out of communications with your organisation.

2.Through conspicuous publication of a work-related electronic address

Consent may also be inferred when someone conspicuously publishes their work-related electronic address (for example, on a website, brochure or magazine); and your business wants to send them a commercial electronic message that relates directly to that person's line of work. However, if a publication includes a statement that the person does not want to receive unsolicited commercial electronic messages at that address, you can not infer consent.

c. FAQs About Consent

If recipients don’t object, is that consent?

No, silence does not constitute consent. Just because a person does not actively unsubscribe from your mailing list does not mean they consent to receiving commercial electronic messages from you. You must have either express or inferred consent before you send such messages.

Can someone subscribe, or give consent, on another person's behalf?

No, not unless they do so using that person's email account. In general, consent to receive commercial electronic messages must be given by the relevant electronic account-holder – the person responsible for that account. This is normally the addressee.
However, if a second person (for example, an executive assistant, supervisor or family member) has access to that account, any consent given by that second person is taken to have come from the account-holder. If consent is mistakenly given, the account-holder can withdraw it by unsubscribing.
In some businesses, authority over electronic accounts may rest with a director or officer, rather than the actual user. That person, who has the authority and capacity to act on behalf of the company, can also give consent. If you are gaining consent over the telephone and are in any doubt about who is responsible for the email address, seek clear confirmation.

Can I use pre-checked tick boxes to gain express consent?

In ACMA’s view an individual providing their information on a screen with a pre-checked tick box does not constitute consent.

However as previously described a clear an unambiguous conditional statement such as “To subscribe to our e-newsletter and receive information on our products and services by email provide your email address/mobile telephone number here ….” should be sufficient to obtain consent.

Responding to a customer enquiry: do I have consent?

If you are replying to a customer enquiry, you have that person’s consent to send them a commercial electronic message related to their enquiry. You may also include extra information (such as price lists and a link to your website) if the customer could reasonably expect to receive such information as a result of their enquiry.

Every commercial electronic message must contain an unsubscribe facility, even if it is a one-off communication in response to an enquiry. It may be easier to make the unsubscribe facility part of your corporate signature, so that it is included on every email your business sends.
Generally, you cannot add a person to a mailing list on the basis of a one-off enquiry. You need to determine whether they would have a reasonable expectation of receiving your commercial electronic messages. This will relate to the nature of their initial enquiry.

Address Harvesting

The supply or use of address harvesting software or harvested email addresses for the purpose of sending spam is prohibited. Under Australian law, a message does not necessarily have to be sent out in bulk to be considered spam. A single message can be considered spam.

Sender Identification

Any commercial electronic message you send must contain accurate identifying information about you, as the person or organisation that authorised the sending of the message. If this condition is not met, the message is classified as spam.

This information must remain correct and valid for at least 30 days after the message is sent.
Every commercial electronic message you send must:

1.Clearly and accurately identify the individual or organisation who authorised the sending of the message. For example if your organisation gets a third party to send out messages on its behalf, the message must clearly identify the organisation on whose behalf the message is being sent – the correct legal name of the organisation or individual, and an Australian Business Number, where applicable.

2.Include accurate information about how the recipient can contact your organisation, or you as an individual sender, for example, a physical or virtual address and a telephone number.

 

Spam Act Enforcement

The Australian Communications and Media Authority (ACMA) is responsible for enforcing the Spam Act and actively works to fight spam in Australia. ACMA has been given significant powers to regulate and enforce the Spam Act 2003 including financial penalties and sanctions. The maximum penalty for a breach of the Spam Act is $1.1m per contravention – that’s $1.1m for every non-compliant message sent.

Prospecting

You cannot email prospective customers unless express or inferred consent already exists. The Spam Act prohibits the sending of unsolicited commercial electronic messages. This includes messages that aim to 'test the water', or gauge the recipient's interest in receiving future commercial messages. These kinds of messages are in themselves commercial, as they seek to establish a commercial relationship. You need to gain consent through other means, such as a letter, a phone call or a face-to-face conversation.

Viral Marketing

The term viral marketing relates to marketing campaigns where the marketer assists the spread of a marketing message by providing a forwarding facility or directs an existing contact to the details for potential end recipients. Viral marketing is also sometimes referred to as member-get-member marketing or refer-a-friend. Viral marketing does not include instances where an individual, without direction or prompting, merely forwards a marketing message to an interested friend or contact.

Viral marketing is not prohibited by the Spam Act 2003. However, members who intend to undertake a viral marketing or member-get-member campaign will need to conduct it in a specific way to ensure compliance with the legislation.

Unsubscribe Facility

Under the Spam Act, every commercial electronic message must contain a functional and legitimate 'unsubscribe' facility. This is an electronic address the recipient can use to tell the sender (or the person or organisation that authorised the sending of the message) that they do not wish to receive future messages.

Businesses must make it easy for people to unsubscribe from electronic mailing lists. An unsubscribe facility must satisfy the following conditions:

• It must remain functional for at least 30 days after the original message was sent
• It must allow the unsubscribe message to be sent to whoever authorised the sending of the message, not necessarily any third party that sent it on their behalf
• Unsubscribe instructions must be presented in a clear and conspicuous way
• A request to unsubscribe must be honoured within five working days
• Unsubscribing must be at low cost, or no cost, to the user (for example, in the case of SMS unsubscribe facilities, a 1800- telephone number would be acceptable).

An unsubscribe facility may also be a link to a website where the person can easily click a button to remove themselves from a mailing list. Unsubscribe facilities must always be easily accessible, must not require the payment of a fee to the sender of the original message or a related person, and must not cost more than the usual cost (if any) of using such addresses.

Every commercial electronic message must contain an unsubscribe facility, even if it is a one-off communication in response to an enquiry. It is a good idea to make the unsubscribe facility part of your corporate signature, so that it is included on every email your business sends.

While commercial electronic messages do require a functional unsubscribe facility, in some cases this may be omitted where both parties agree otherwise. For example, a supplier and customer who exchange regular emails about a transaction may agree not to include an unsubscribe facility in every message. This can be a contractual arrangement or simply a mutual agreement.

An unsubscribe facility is not required where it would be inconsistent with the terms of a contract or agreement between the sender (whoever authorised the message) and recipient (the electronic account-holder) – for example, when a contract between two parties requires the sending of regular updates; or where the conditions of membership to an association require the sharing of commercial information between members via email. However, it would not be acceptable for the sender to vary the terms of an existing contract to make the receipt of marketing messages mandatory. That would not constitute the recipient giving consent.

Enforcement

The Australian Communications and Media Authority (ACMA) is responsible for enforcing the Spam Act and actively works to fight spam in Australia. ACMA has been given significant powers to regulate and enforce the Spam Act 2003 including financial penalties and sanctions. The maximum penalty for a breach of the Spam Act is $1.1m per contravention – that’s $1.1m for every non-compliant message sent.

Viral marketing information sheet

Spam Act information sheet